Privacy Policy

1. Introduction

Welcome to LocalXP and Local Commons, operated by Pixel Mixel Inc. ("we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (including the Local Commons living map).

By accessing or using our services, you agree to the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide

Required to create an account:

• Email address — used solely to send your one-time login code (OTP). We do not use your email for marketing without your explicit consent.

Optional — you choose what to share:

• Username — a display name for leaderboards and community features (does not need to be your real name)
• Real name — entirely optional, only if you choose to add it to your profile
• City / province or state — entirely optional, used for local community discovery if provided
• Profile picture — optional, for personalization
• Business information — only if you create a business account

You can use LocalXP with only your email address. All other profile information is voluntary and can be added, changed, or removed at any time.

2.2 Automatically Collected Information

When you use LocalXP, we automatically collect:

• Device information (IP address, browser type, operating system) — for security and fraud prevention
• Participation events (time, venue ID, interaction type, XP earned) — linked to your user ID, not your name or email
• Location data — only when you grant browser permission, used for QR verification and local discovery
• Analytics data (pages viewed, features used) — only if you consent via the cookie banner
• Session tokens — necessary for keeping you logged in securely

2.3 Photos and embedded metadata (EXIF)

When you upload a photo to certain features (including Local Commons event participation photos and similar evidence uploads), we may read technical metadata embedded in the file, commonly called EXIF. That can include:

• Capture time (when the camera recorded the photo)
• GPS coordinates (when the camera stored a location)
• Limited device or camera identifiers when present in the file

We use this information to verify that a contribution is consistent with the place and time of the event or report (for example, that an event photo was taken near the venue during the event window). Uploads that fail these checks may be rejected.

Verified contribution details may be stored with the photo (such as capture time and approximate GPS used for validation) and associated with your account. The public living map typically shows the photo and optional credit name, not a full EXIF dump. After processing, we may strip or rewrite image files for storage and delivery. Do not upload photos you do not want associated with a place and time on the map.

2.4 Payment Information

Payment processing is handled by Stripe, our third-party payment processor. We do not store your complete credit card information. Stripe collects and processes payment information in accordance with their privacy policy and PCI-DSS standards.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Process transactions and send transaction notifications
• Create and manage your account
• Enable community features and social interactions
• Personalize your experience and content recommendations
• Send administrative information and updates
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address fraud and security issues
• Verify place-based photo contributions using embedded capture time and location metadata when provided
• Comply with legal obligations
• Send marketing communications (with your consent)
• Provide community engagement insights to support business success (see Section 3.1)

3.1 How Participation Data Is Recorded

3.2 Community Engagement Insights

What We Collect for Engagement Insights:

• Profile completeness metrics
• Login activity patterns
• Content creation frequency
• Campaign participation
• Response rates and engagement levels

4. Information Sharing and Disclosure

4.1 Community Visibility

Information you share within communities (posts, comments, profile information) may be visible to other community members according to the community's privacy settings.

4.2 Service Providers

We share information with trusted third-party service providers who assist us in:

• Payment processing (Stripe)
• Cloud hosting and storage (Supabase, Vercel)
• Analytics and performance monitoring
• Email delivery services
• Customer support tools

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or to protect our rights, property, or safety, or that of our users or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security audits and monitoring
• Employee training on data protection
• Compliance with PCI-DSS standards for payment data

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Update

You can access and update your account information at any time through your profile settings.

6.2 Data Portability

You have the right to request a copy of your personal data in a structured, machine-readable format.

6.3 Deletion

You can request deletion of your account and personal data by contacting us at hello@localxp.ca. Some information may be retained as required by law or for legitimate business purposes.

6.4 Marketing Communications

You can opt out of marketing emails by clicking the unsubscribe link in any marketing email or updating your communication preferences in your account settings.

6.5 Cookies & Consent

We use a cookie consent banner to give you control over non-essential cookies. We use three categories:

• Necessary — Always active. Required for login, sessions, security, and core product features including XP tracking and participation recording.
• Analytics — Optional. Google Analytics to understand how visitors use the site. Denied by default until you consent.
• Functional — Optional. Remembers your theme, language, and display preferences.

You can update your cookie preferences at any time via the cookie banner or through your account settings under Privacy & Data.

7. Children's Privacy

LocalXP is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

8. International Data Transfers

LocalXP is operated from Canada. Your information may be processed by our service providers in other countries, including the United States (Supabase, Vercel, Stripe, Google Analytics). These transfers are made on the basis of:

• Contractual necessity (to provide the Services you requested)
• Standard Contractual Clauses or equivalent safeguards where required by applicable law
• The legitimate interests of operating a globally-hosted cloud platform

We ensure our service providers maintain appropriate data protection standards. For questions about international transfers, contact hello@localxp.ca.

8A. Data Retention

We retain your personal information for as long as necessary to provide the Services and comply with our legal obligations:

• Account data: Retained while your account is active, then deleted 30 days after account deletion request
• Transaction records: Retained for 7 years to comply with Canadian tax and accounting laws
• Analytics data: Aggregated and anonymized after 26 months (Google Analytics default)
• Audit logs: Retained for 2 years for security and fraud prevention
• Cookie consent records: Retained for 1 year from the date of consent

9. Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of LocalXP after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

12. Regional Privacy Rights

12.1 Canadian Residents (PIPEDA)

LocalXP is operated by Pixel Mixel Inc., a Canadian corporation subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Canadian residents have the right to:

• Access the personal information we hold about you
• Challenge the accuracy and completeness of your information and have it amended
• Withdraw consent for non-essential data processing (subject to legal and contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise these rights, contact our Privacy Officer at hello@localxp.ca.

12.2 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell your personal information.

12.3 European Residents (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including:

• Access (Art. 15): Request a copy of your data via Settings → Privacy & Data → Export My Data
• Rectification (Art. 16): Correct inaccurate data via your profile settings
• Erasure (Art. 17): Delete your account via Settings → Privacy & Data → Delete Account
• Restriction (Art. 18): Request restriction of processing by contacting hello@localxp.ca
• Portability (Art. 20): Download your data in JSON format via the data export tool
• Object (Art. 21): Object to processing based on legitimate interests by contacting hello@localxp.ca
• Withdraw consent: Update cookie preferences at any time via the cookie banner

You also have the right to lodge a complaint with your local data protection authority. We will respond to all requests within 30 days.